Inventory and ownership
Record base URLs, environments, versions, owners, sensitive operations, and exclusions. Identify which third parties are outside your authority to test. Include documentation where available and flag known differences between the specification and deployed behavior.
Documentation and authentication
Provide an approved OpenAPI specification or operation list. Explain the supported authentication flow, token lifetime, and any conditions for access. Transfer credentials through an agreed secure channel—not through a website contact form or a report attachment.
Roles, tenants, and objects
Document the roles and tenants used in the evaluation. For each sensitive operation, state who should be allowed to perform it and which resources they may access. Use approved synthetic data where possible. Do not create test records in a production environment without permission.
Illustrative permission matrix
For a sample invoice API: a member can view invoices owned by their tenant; a billing administrator may export that tenant’s invoices; a user from a different tenant should not access either resource. Treat read, update, export, and administrative operations as separate expectations.
Operating limits
Agree request limits, assessment windows, prohibited operations, impact restrictions, escalation contacts, and a stop procedure. State whether an action that might modify or delete data is permitted. Written boundaries matter even when tests are automated.
Evidence and handoff
Agree how requests and responses are minimized, who may see the evidence, how secrets are removed, and how long material is retained. A developer needs the role/resource context and expected behavior to understand a suspected authorization problem.
Retest inputs
After a change, record the deployment or environment being retested, access conditions, and the original behavior to revisit. A retest should confirm a specific boundary and preserve appropriate allowed behavior; it is not a fresh guarantee about the entire API.
Bring this brief to an evaluation
Share a high-level version of your requirements with Turix. API protocol support, authentication handling, and assessment coverage must be confirmed individually. The early-access form is for a conversation, not for submitting credentials or starting a test.
Further reading
Authoritative references for the assessment concepts discussed here.